Fake TradingView Software Found Stealing Crypto Wallet Data

Fake TradingView software identified as crypto-stealing malware

Blockchain security firm SlowMist has issued an alert regarding a malicious Windows program. The software is being promoted on social media as a free 'cracked' version of TradingView Premium, which is a popular platform used for tracking market charts.

SlowMist confirmed that the program is an 'infostealer.' This type of malware is designed to gather sensitive information from the user's computer, including browser credentials, Telegram data, and information from crypto wallets—which are digital tools used to store and manage cryptocurrency.

Key details about the malware campaign

• The malware is promoted on X by an account named @cryptotrice.
• Promotional posts have reached over 300,000 views since mid-October.
• The attackers use Telegram and Steam to find and switch their command servers.
• The installation process involves extracting a password-protected file and running a desktop program.

Findings from the security firm analysis

SlowMist reported that the software sends stolen data to servers controlled by the attackers. While the security firm analyzed a Windows version, a link for a macOS version resulted in an error, meaning researchers have not yet obtained a sample for Apple computers.

The security firm also identified websites used to distribute the malware, such as halchemicals[.]com and arche-hypnose[.]com. SlowMist noted that arche-hypnose[.]com appears to be a legitimate website that was likely compromised to host the malicious files.

Confirmed facts and current uncertainties

SlowMist has confirmed that the Windows sample is functional malware. However, the report does not mention any confirmed thefts or provide a count of how many people have been affected so far.

Recommended safety steps for exposed users

SlowMist advises anyone who has run the suspicious software to take immediate action to protect their funds:

• Disconnect the infected computer from the network right away.
• Use a clean, separate device to move assets to a new wallet with a new seed phrase—a series of words used as a master password to recover a wallet.
• Update passwords for email accounts, crypto exchanges, and social media.
• End all active sessions on Telegram.

Sources

• The Defiant